CVE-2025-12350

DominoKit <= 1.1.0 - Missing Authorization to Unauthenticated Settings Update

CVSS 5.3 MEDIUMEPSS 0.2%CWE-862

The DominoKit plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the wp_ajax_nopriv_dominokit_option_admin_action AJAX endpoint in all versions up to, and including, 1.1.0. This makes it possible for unauthenticated attackers to update plugin settings.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Produtos afetados

domiinodev · DominoKit

Quer saber se a sua infraestrutura está exposta a isto?

Falar com a TrueHacking →

Referências

https://wordpress.org/plugins/dominokit/https://www.wordfence.com/threat-intel/vulnerabilities/id/1c8de019-4ec1-49fd-9b0b-c2b1b6908ba8?source=cve